[linux-block.git] / net / netfilter / xt_tcpudp.c

// SPDX-License-Identifier: GPL-2.0-only
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/types.h>
#include <linux/module.h>
#include <net/ip.h>
#include <linux/ipv6.h>
#include <linux/icmp.h>
#include <net/ipv6.h>
#include <net/tcp.h>
#include <net/udp.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_tcpudp.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match");
MODULE_LICENSE("GPL");
MODULE_ALIAS("xt_tcp");
MODULE_ALIAS("xt_udp");
MODULE_ALIAS("ipt_udp");
MODULE_ALIAS("ipt_tcp");
MODULE_ALIAS("ip6t_udp");
MODULE_ALIAS("ip6t_tcp");
MODULE_ALIAS("ipt_icmp");
MODULE_ALIAS("ip6t_icmp6");

/* Returns 1 if the port is matched by the range, 0 otherwise */
static inline bool
port_match(u_int16_t min, u_int16_t max, u_int16_t port, bool invert)
{
	return (port >= min && port <= max) ^ invert;
}

static bool
tcp_find_option(u_int8_t option,
		const struct sk_buff *skb,
		unsigned int protoff,
		unsigned int optlen,
		bool invert,
		bool *hotdrop)
{
	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	const u_int8_t *op;
	u_int8_t _opt[60 - sizeof(struct tcphdr)];
	unsigned int i;

	pr_debug("finding option\n");

	if (!optlen)
		return invert;

	/* If we don't have the whole header, drop packet. */
	op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr),
				optlen, _opt);
	if (op == NULL) {
		*hotdrop = true;
		return false;
	}

	for (i = 0; i < optlen; ) {
		if (op[i] == option) return !invert;
		if (op[i] < 2) i++;
		else i += op[i+1]?:1;
	}

	return invert;
}

static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct tcphdr *th;
	struct tcphdr _tcph;
	const struct xt_tcp *tcpinfo = par->matchinfo;

	if (par->fragoff != 0) {
		/* To quote Alan:

		   Don't allow a fragment of TCP 8 bytes in. Nobody normal
		   causes this. Its a cracker trying to break in by doing a
		   flag overwrite to pass the direction checks.
		*/
		if (par->fragoff == 1) {
			pr_debug("Dropping evil TCP offset=1 frag.\n");
			par->hotdrop = true;
		}
		/* Must not be a fragment. */
		return false;
	}

	th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
	if (th == NULL) {
		/* We've been asked to examine this packet, and we
		   can't.  Hence, no choice but to drop. */
		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
		par->hotdrop = true;
		return false;
	}

	if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1],
			ntohs(th->source),
			!!(tcpinfo->invflags & XT_TCP_INV_SRCPT)))
		return false;
	if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1],
			ntohs(th->dest),
			!!(tcpinfo->invflags & XT_TCP_INV_DSTPT)))
		return false;
	if (!NF_INVF(tcpinfo, XT_TCP_INV_FLAGS,
		     (((unsigned char *)th)[13] & tcpinfo->flg_mask) == tcpinfo->flg_cmp))
		return false;
	if (tcpinfo->option) {
		if (th->doff * 4 < sizeof(_tcph)) {
			par->hotdrop = true;
			return false;
		}
		if (!tcp_find_option(tcpinfo->option, skb, par->thoff,
				     th->doff*4 - sizeof(_tcph),
				     tcpinfo->invflags & XT_TCP_INV_OPTION,
				     &par->hotdrop))
			return false;
	}
	return true;
}

static int tcp_mt_check(const struct xt_mtchk_param *par)
{
	const struct xt_tcp *tcpinfo = par->matchinfo;

	/* Must specify no unknown invflags */
	return (tcpinfo->invflags & ~XT_TCP_INV_MASK) ? -EINVAL : 0;
}

static bool udp_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct udphdr *uh;
	struct udphdr _udph;
	const struct xt_udp *udpinfo = par->matchinfo;

	/* Must not be a fragment. */
	if (par->fragoff != 0)
		return false;

	uh = skb_header_pointer(skb, par->thoff, sizeof(_udph), &_udph);
	if (uh == NULL) {
		/* We've been asked to examine this packet, and we
		   can't.  Hence, no choice but to drop. */
		pr_debug("Dropping evil UDP tinygram.\n");
		par->hotdrop = true;
		return false;
	}

	return port_match(udpinfo->spts[0], udpinfo->spts[1],
			  ntohs(uh->source),
			  !!(udpinfo->invflags & XT_UDP_INV_SRCPT))
		&& port_match(udpinfo->dpts[0], udpinfo->dpts[1],
			      ntohs(uh->dest),
			      !!(udpinfo->invflags & XT_UDP_INV_DSTPT));
}

static int udp_mt_check(const struct xt_mtchk_param *par)
{
	const struct xt_udp *udpinfo = par->matchinfo;

	/* Must specify no unknown invflags */
	return (udpinfo->invflags & ~XT_UDP_INV_MASK) ? -EINVAL : 0;
}

/* Returns 1 if the type and code is matched by the range, 0 otherwise */
static bool type_code_in_range(u8 test_type, u8 min_code, u8 max_code,
			       u8 type, u8 code)
{
	return type == test_type && code >= min_code && code <= max_code;
}

static bool icmp_type_code_match(u8 test_type, u8 min_code, u8 max_code,
				 u8 type, u8 code, bool invert)
{
	return (test_type == 0xFF ||
		type_code_in_range(test_type, min_code, max_code, type, code))
		^ invert;
}

static bool icmp6_type_code_match(u8 test_type, u8 min_code, u8 max_code,
				  u8 type, u8 code, bool invert)
{
	return type_code_in_range(test_type, min_code, max_code, type, code) ^ invert;
}

static bool
icmp_match(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct icmphdr *ic;
	struct icmphdr _icmph;
	const struct ipt_icmp *icmpinfo = par->matchinfo;

	/* Must not be a fragment. */
	if (par->fragoff != 0)
		return false;

	ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
	if (!ic) {
		/* We've been asked to examine this packet, and we
		 * can't.  Hence, no choice but to drop.
		 */
		par->hotdrop = true;
		return false;
	}

	return icmp_type_code_match(icmpinfo->type,
				    icmpinfo->code[0],
				    icmpinfo->code[1],
				    ic->type, ic->code,
				    !!(icmpinfo->invflags & IPT_ICMP_INV));
}

static bool
icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct icmp6hdr *ic;
	struct icmp6hdr _icmph;
	const struct ip6t_icmp *icmpinfo = par->matchinfo;

	/* Must not be a fragment. */
	if (par->fragoff != 0)
		return false;

	ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
	if (!ic) {
		/* We've been asked to examine this packet, and we
		 * can't.  Hence, no choice but to drop.
		 */
		par->hotdrop = true;
		return false;
	}

	return icmp6_type_code_match(icmpinfo->type,
				     icmpinfo->code[0],
				     icmpinfo->code[1],
				     ic->icmp6_type, ic->icmp6_code,
				     !!(icmpinfo->invflags & IP6T_ICMP_INV));
}

static int icmp_checkentry(const struct xt_mtchk_param *par)
{
	const struct ipt_icmp *icmpinfo = par->matchinfo;

	return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
}

static int icmp6_checkentry(const struct xt_mtchk_param *par)
{
	const struct ip6t_icmp *icmpinfo = par->matchinfo;

	return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
}

static struct xt_match tcpudp_mt_reg[] __read_mostly = {
	{
		.name		= "tcp",
		.family		= NFPROTO_IPV4,
		.checkentry	= tcp_mt_check,
		.match		= tcp_mt,
		.matchsize	= sizeof(struct xt_tcp),
		.proto		= IPPROTO_TCP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "tcp",
		.family		= NFPROTO_IPV6,
		.checkentry	= tcp_mt_check,
		.match		= tcp_mt,
		.matchsize	= sizeof(struct xt_tcp),
		.proto		= IPPROTO_TCP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "udp",
		.family		= NFPROTO_IPV4,
		.checkentry	= udp_mt_check,
		.match		= udp_mt,
		.matchsize	= sizeof(struct xt_udp),
		.proto		= IPPROTO_UDP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "udp",
		.family		= NFPROTO_IPV6,
		.checkentry	= udp_mt_check,
		.match		= udp_mt,
		.matchsize	= sizeof(struct xt_udp),
		.proto		= IPPROTO_UDP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "udplite",
		.family		= NFPROTO_IPV4,
		.checkentry	= udp_mt_check,
		.match		= udp_mt,
		.matchsize	= sizeof(struct xt_udp),
		.proto		= IPPROTO_UDPLITE,
		.me		= THIS_MODULE,
	},
	{
		.name		= "udplite",
		.family		= NFPROTO_IPV6,
		.checkentry	= udp_mt_check,
		.match		= udp_mt,
		.matchsize	= sizeof(struct xt_udp),
		.proto		= IPPROTO_UDPLITE,
		.me		= THIS_MODULE,
	},
	{
		.name       = "icmp",
		.match      = icmp_match,
		.matchsize  = sizeof(struct ipt_icmp),
		.checkentry = icmp_checkentry,
		.proto      = IPPROTO_ICMP,
		.family     = NFPROTO_IPV4,
		.me         = THIS_MODULE,
	},
	{
		.name       = "icmp6",
		.match      = icmp6_match,
		.matchsize  = sizeof(struct ip6t_icmp),
		.checkentry = icmp6_checkentry,
		.proto      = IPPROTO_ICMPV6,
		.family     = NFPROTO_IPV6,
		.me	    = THIS_MODULE,
	},
};

static int __init tcpudp_mt_init(void)
{
	return xt_register_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
}

static void __exit tcpudp_mt_exit(void)
{
	xt_unregister_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
}

module_init(tcpudp_mt_init);
module_exit(tcpudp_mt_exit);
Commit	Line	Data
09c434b8	1	// SPDX-License-Identifier: GPL-2.0-only
be91fd5e	2	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
2e4e6a17 HW	3	#include <linux/types.h>
	4	#include <linux/module.h>
	5	#include <net/ip.h>
37d8dc82	6	#include <linux/ipv6.h>
36ce9982	7	#include <linux/icmp.h>
2e4e6a17 HW	8	#include <net/ipv6.h>
	9	#include <net/tcp.h>
	10	#include <net/udp.h>
	11	#include <linux/netfilter/x_tables.h>
	12	#include <linux/netfilter/xt_tcpudp.h>
	13	#include <linux/netfilter_ipv4/ip_tables.h>
	14	#include <linux/netfilter_ipv6/ip6_tables.h>
	15
2ae15b64	16	MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match");
2e4e6a17 HW	17	MODULE_LICENSE("GPL");
	18	MODULE_ALIAS("xt_tcp");
	19	MODULE_ALIAS("xt_udp");
	20	MODULE_ALIAS("ipt_udp");
	21	MODULE_ALIAS("ipt_tcp");
	22	MODULE_ALIAS("ip6t_udp");
	23	MODULE_ALIAS("ip6t_tcp");
36ce9982 FW	24	MODULE_ALIAS("ipt_icmp");
36ce9982 FW	25	MODULE_ALIAS("ip6t_icmp6");
2e4e6a17	26
2e4e6a17	27	/* Returns 1 if the port is matched by the range, 0 otherwise */
1d93a9cb JE	28	static inline bool
1d93a9cb JE	29	port_match(u_int16_t min, u_int16_t max, u_int16_t port, bool invert)
2e4e6a17	30	{
1d93a9cb	31	return (port >= min && port <= max) ^ invert;
2e4e6a17 HW	32	}
2e4e6a17 HW	33
1d93a9cb	34	static bool
2e4e6a17 HW	35	tcp_find_option(u_int8_t option,
	36	const struct sk_buff *skb,
	37	unsigned int protoff,
	38	unsigned int optlen,
1d93a9cb	39	bool invert,
cff533ac	40	bool *hotdrop)
2e4e6a17 HW	41	{
2e4e6a17 HW	42	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
3cf93c96 JE	43	const u_int8_t *op;
3cf93c96 JE	44	u_int8_t _opt[60 - sizeof(struct tcphdr)];
2e4e6a17 HW	45	unsigned int i;
2e4e6a17 HW	46
be91fd5e	47	pr_debug("finding option\n");
2e4e6a17 HW	48
	49	if (!optlen)
	50	return invert;
	51
	52	/* If we don't have the whole header, drop packet. */
	53	op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr),
	54	optlen, _opt);
	55	if (op == NULL) {
cff533ac	56	*hotdrop = true;
1d93a9cb	57	return false;
2e4e6a17 HW	58	}
	59
	60	for (i = 0; i < optlen; ) {
	61	if (op[i] == option) return !invert;
	62	if (op[i] < 2) i++;
	63	else i += op[i+1]?:1;
	64	}
	65
	66	return invert;
	67	}
	68
62fc8051	69	static bool tcp_mt(const struct sk_buff skb, struct xt_action_param par)
2e4e6a17	70	{
3cf93c96 JE	71	const struct tcphdr *th;
3cf93c96 JE	72	struct tcphdr _tcph;
f7108a20	73	const struct xt_tcp *tcpinfo = par->matchinfo;
2e4e6a17	74
f7108a20	75	if (par->fragoff != 0) {
2e4e6a17 HW	76	/* To quote Alan:
	77
	78	Don't allow a fragment of TCP 8 bytes in. Nobody normal
	79	causes this. Its a cracker trying to break in by doing a
	80	flag overwrite to pass the direction checks.
	81	*/
f7108a20	82	if (par->fragoff == 1) {
be91fd5e	83	pr_debug("Dropping evil TCP offset=1 frag.\n");
b4ba2611	84	par->hotdrop = true;
2e4e6a17 HW	85	}
2e4e6a17 HW	86	/* Must not be a fragment. */
1d93a9cb	87	return false;
2e4e6a17 HW	88	}
2e4e6a17 HW	89
f7108a20	90	th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
2e4e6a17 HW	91	if (th == NULL) {
	92	/* We've been asked to examine this packet, and we
	93	can't. Hence, no choice but to drop. */
be91fd5e	94	pr_debug("Dropping evil TCP offset=0 tinygram.\n");
b4ba2611	95	par->hotdrop = true;
1d93a9cb	96	return false;
2e4e6a17 HW	97	}
	98
	99	if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1],
	100	ntohs(th->source),
	101	!!(tcpinfo->invflags & XT_TCP_INV_SRCPT)))
1d93a9cb	102	return false;
2e4e6a17 HW	103	if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1],
	104	ntohs(th->dest),
	105	!!(tcpinfo->invflags & XT_TCP_INV_DSTPT)))
1d93a9cb	106	return false;
c37a2dfa JP	107	if (!NF_INVF(tcpinfo, XT_TCP_INV_FLAGS,
c37a2dfa JP	108	(((unsigned char *)th)[13] & tcpinfo->flg_mask) == tcpinfo->flg_cmp))
1d93a9cb	109	return false;
2e4e6a17 HW	110	if (tcpinfo->option) {
2e4e6a17 HW	111	if (th->doff * 4 < sizeof(_tcph)) {
b4ba2611	112	par->hotdrop = true;
1d93a9cb	113	return false;
2e4e6a17	114	}
f7108a20	115	if (!tcp_find_option(tcpinfo->option, skb, par->thoff,
2e4e6a17 HW	116	th->doff*4 - sizeof(_tcph),
2e4e6a17 HW	117	tcpinfo->invflags & XT_TCP_INV_OPTION,
b4ba2611	118	&par->hotdrop))
1d93a9cb	119	return false;
2e4e6a17	120	}
1d93a9cb	121	return true;
2e4e6a17 HW	122	}
2e4e6a17 HW	123
b0f38452	124	static int tcp_mt_check(const struct xt_mtchk_param *par)
2e4e6a17	125	{
9b4fce7a	126	const struct xt_tcp *tcpinfo = par->matchinfo;
2e4e6a17	127
5d04bff0	128	/* Must specify no unknown invflags */
bd414ee6	129	return (tcpinfo->invflags & ~XT_TCP_INV_MASK) ? -EINVAL : 0;
2e4e6a17 HW	130	}
2e4e6a17 HW	131
62fc8051	132	static bool udp_mt(const struct sk_buff skb, struct xt_action_param par)
2e4e6a17	133	{
3cf93c96 JE	134	const struct udphdr *uh;
3cf93c96 JE	135	struct udphdr _udph;
f7108a20	136	const struct xt_udp *udpinfo = par->matchinfo;
2e4e6a17 HW	137
2e4e6a17 HW	138	/* Must not be a fragment. */
f7108a20	139	if (par->fragoff != 0)
1d93a9cb	140	return false;
2e4e6a17	141
f7108a20	142	uh = skb_header_pointer(skb, par->thoff, sizeof(_udph), &_udph);
2e4e6a17 HW	143	if (uh == NULL) {
	144	/* We've been asked to examine this packet, and we
	145	can't. Hence, no choice but to drop. */
be91fd5e	146	pr_debug("Dropping evil UDP tinygram.\n");
b4ba2611	147	par->hotdrop = true;
1d93a9cb	148	return false;
2e4e6a17 HW	149	}
	150
	151	return port_match(udpinfo->spts[0], udpinfo->spts[1],
	152	ntohs(uh->source),
	153	!!(udpinfo->invflags & XT_UDP_INV_SRCPT))
	154	&& port_match(udpinfo->dpts[0], udpinfo->dpts[1],
	155	ntohs(uh->dest),
	156	!!(udpinfo->invflags & XT_UDP_INV_DSTPT));
	157	}
	158
b0f38452	159	static int udp_mt_check(const struct xt_mtchk_param *par)
2e4e6a17	160	{
9b4fce7a	161	const struct xt_udp *udpinfo = par->matchinfo;
2e4e6a17	162
5d04bff0	163	/* Must specify no unknown invflags */
bd414ee6	164	return (udpinfo->invflags & ~XT_UDP_INV_MASK) ? -EINVAL : 0;
2e4e6a17 HW	165	}
2e4e6a17 HW	166
36ce9982 FW	167	/* Returns 1 if the type and code is matched by the range, 0 otherwise */
	168	static bool type_code_in_range(u8 test_type, u8 min_code, u8 max_code,
	169	u8 type, u8 code)
	170	{
	171	return type == test_type && code >= min_code && code <= max_code;
	172	}
	173
	174	static bool icmp_type_code_match(u8 test_type, u8 min_code, u8 max_code,
	175	u8 type, u8 code, bool invert)
	176	{
	177	return (test_type == 0xFF \|\|
	178	type_code_in_range(test_type, min_code, max_code, type, code))
	179	^ invert;
	180	}
	181
	182	static bool icmp6_type_code_match(u8 test_type, u8 min_code, u8 max_code,
	183	u8 type, u8 code, bool invert)
	184	{
	185	return type_code_in_range(test_type, min_code, max_code, type, code) ^ invert;
	186	}
	187
	188	static bool
	189	icmp_match(const struct sk_buff skb, struct xt_action_param par)
	190	{
	191	const struct icmphdr *ic;
	192	struct icmphdr _icmph;
	193	const struct ipt_icmp *icmpinfo = par->matchinfo;
	194
	195	/* Must not be a fragment. */
	196	if (par->fragoff != 0)
	197	return false;
	198
	199	ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
	200	if (!ic) {
	201	/* We've been asked to examine this packet, and we
	202	* can't. Hence, no choice but to drop.
	203	*/
	204	par->hotdrop = true;
	205	return false;
	206	}
	207
	208	return icmp_type_code_match(icmpinfo->type,
	209	icmpinfo->code[0],
	210	icmpinfo->code[1],
	211	ic->type, ic->code,
	212	!!(icmpinfo->invflags & IPT_ICMP_INV));
	213	}
	214
	215	static bool
	216	icmp6_match(const struct sk_buff skb, struct xt_action_param par)
	217	{
	218	const struct icmp6hdr *ic;
	219	struct icmp6hdr _icmph;
	220	const struct ip6t_icmp *icmpinfo = par->matchinfo;
	221
	222	/* Must not be a fragment. */
	223	if (par->fragoff != 0)
	224	return false;
	225
	226	ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
	227	if (!ic) {
	228	/* We've been asked to examine this packet, and we
	229	* can't. Hence, no choice but to drop.
	230	*/
231	par->hotdrop = true;
232	return false;
233	}
234
235	return icmp6_type_code_match(icmpinfo->type,
236	icmpinfo->code[0],
237	icmpinfo->code[1],
238	ic->icmp6_type, ic->icmp6_code,
239	!!(icmpinfo->invflags & IP6T_ICMP_INV));
240	}
241
242	static int icmp_checkentry(const struct xt_mtchk_param *par)
243	{
244	const struct ipt_icmp *icmpinfo = par->matchinfo;
245
246	return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
247	}
248
249	static int icmp6_checkentry(const struct xt_mtchk_param *par)
250	{
251	const struct ip6t_icmp *icmpinfo = par->matchinfo;
252
253	return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
254	}
255
d3c5ee6d	256	static struct xt_match tcpudp_mt_reg[] __read_mostly = {
4470bbc7 PM	257	{
4470bbc7 PM	258	.name = "tcp",
ee999d8b	259	.family = NFPROTO_IPV4,
d3c5ee6d JE	260	.checkentry = tcp_mt_check,
d3c5ee6d JE	261	.match = tcp_mt,
4470bbc7 PM	262	.matchsize = sizeof(struct xt_tcp),
	263	.proto = IPPROTO_TCP,
	264	.me = THIS_MODULE,
	265	},
	266	{
	267	.name = "tcp",
ee999d8b	268	.family = NFPROTO_IPV6,
d3c5ee6d JE	269	.checkentry = tcp_mt_check,
d3c5ee6d JE	270	.match = tcp_mt,
4470bbc7 PM	271	.matchsize = sizeof(struct xt_tcp),
	272	.proto = IPPROTO_TCP,
	273	.me = THIS_MODULE,
	274	},
	275	{
	276	.name = "udp",
ee999d8b	277	.family = NFPROTO_IPV4,
d3c5ee6d JE	278	.checkentry = udp_mt_check,
d3c5ee6d JE	279	.match = udp_mt,
4470bbc7 PM	280	.matchsize = sizeof(struct xt_udp),
	281	.proto = IPPROTO_UDP,
	282	.me = THIS_MODULE,
	283	},
	284	{
	285	.name = "udp",
ee999d8b	286	.family = NFPROTO_IPV6,
d3c5ee6d JE	287	.checkentry = udp_mt_check,
d3c5ee6d JE	288	.match = udp_mt,
4470bbc7 PM	289	.matchsize = sizeof(struct xt_udp),
	290	.proto = IPPROTO_UDP,
	291	.me = THIS_MODULE,
	292	},
ba4e58ec GR	293	{
ba4e58ec GR	294	.name = "udplite",
ee999d8b	295	.family = NFPROTO_IPV4,
d3c5ee6d JE	296	.checkentry = udp_mt_check,
d3c5ee6d JE	297	.match = udp_mt,
ba4e58ec GR	298	.matchsize = sizeof(struct xt_udp),
	299	.proto = IPPROTO_UDPLITE,
	300	.me = THIS_MODULE,
	301	},
	302	{
	303	.name = "udplite",
ee999d8b	304	.family = NFPROTO_IPV6,
d3c5ee6d JE	305	.checkentry = udp_mt_check,
d3c5ee6d JE	306	.match = udp_mt,
ba4e58ec GR	307	.matchsize = sizeof(struct xt_udp),
	308	.proto = IPPROTO_UDPLITE,
	309	.me = THIS_MODULE,
	310	},
36ce9982 FW	311	{
	312	.name = "icmp",
	313	.match = icmp_match,
	314	.matchsize = sizeof(struct ipt_icmp),
	315	.checkentry = icmp_checkentry,
	316	.proto = IPPROTO_ICMP,
	317	.family = NFPROTO_IPV4,
	318	.me = THIS_MODULE,
	319	},
	320	{
	321	.name = "icmp6",
	322	.match = icmp6_match,
	323	.matchsize = sizeof(struct ip6t_icmp),
	324	.checkentry = icmp6_checkentry,
	325	.proto = IPPROTO_ICMPV6,
	326	.family = NFPROTO_IPV6,
	327	.me = THIS_MODULE,
	328	},
2e4e6a17 HW	329	};
2e4e6a17 HW	330
d3c5ee6d	331	static int __init tcpudp_mt_init(void)
2e4e6a17	332	{
d3c5ee6d	333	return xt_register_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
2e4e6a17 HW	334	}
2e4e6a17 HW	335
d3c5ee6d	336	static void __exit tcpudp_mt_exit(void)
2e4e6a17	337	{
d3c5ee6d	338	xt_unregister_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg));
2e4e6a17 HW	339	}
2e4e6a17 HW	340
d3c5ee6d JE	341	module_init(tcpudp_mt_init);
d3c5ee6d JE	342	module_exit(tcpudp_mt_exit);